Windows DNS CVE-2026-65798

Exploitation requires local, interactive or session-level access to the target system with high-privilege (administrator-level) credentials, as confirmed by the CVSS vector AV:L/PR:H. Remote unauthenticated exploitation is not possible. The attacker must be an authorized user with existing elevated access on the affected Windows host - this is not a credential-bypass flaw. SSVC confirms the attack is not automatable, ruling out scripted mass exploitation. Exploitation is further gated on the presence of an unpatched version of Windows DNS across the affected Windows 10, Windows 11, or Windows Server release lines listed above. The primary factor limiting real-world risk is the PR:H prerequisite: an attacker who already holds administrator credentials has significant capabilities on the host independent of this vulnerability.

The CVSS 6.7 base score correctly reflects a constrained attack surface: AV:L limits exploitation to local access only, and PR:H mandates that the attacker already holds administrator-level credentials - both significant prerequisites that eliminate opportunistic remote exploitation. SSVC reinforces this picture, rating exploitation status as 'none' and the attack as not automatable, confirming this is not a mass-exploitation scenario. Counterbalancing these constraints, SSVC rates Technical Impact as 'total', and the CVSS impact triad (C:H/I:H/A:H) confirms that successful exploitation yields full system compromise - a meaningful outcome even from a high-privilege starting point, since DNS service control can be a stepping stone to deeper persistence or lateral movement. Given the ubiquity of Windows DNS in enterprise and government infrastructure, even a mid-sized municipal IT team in gliwice should treat patching as a near-term priority, particularly for exposed Windows Server DNS roles. A notable discrepancy exists between the 'Information Disclosure' tag from source intelligence and the primary description of privilege escalation; whether this tag reflects an additional impact path or is a metadata artifact is not confirmed from available data. No EPSS score was provided in the source data.

An insider or attacker who has already achieved administrator-level access on a Windows host submits a specially crafted input to the Windows DNS service that triggers a numeric truncation error during integer conversion, corrupting a service-internal value. The corrupted state allows the attacker to redirect execution or manipulate the DNS service's privilege context, escalating from high-privilege user to SYSTEM-level control. No public exploit code has been identified at time of analysis.